File 0001-Allow-domain-admin-to-list-projest-assignments.patch of Package openstack-keystone

From 3630352b9f6c718be63c704d7ef062b8bc01ea19 Mon Sep 17 00:00:00 2001
From: Boris Bobrov <bbobrov@suse.com>
Date: Mon, 3 Jun 2019 20:32:41 +0200
Subject: [PATCH] Allow domain admin to list projest assignments

Domain admin (i.e. admin role on the given domain) is able to list the
role assignments on the domain (with the --domain filter) itself and the
projects (with the --project filter) under that domain.
---
 keystone/assignment/controllers.py | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/keystone/assignment/controllers.py b/keystone/assignment/controllers.py
index 762101ad1..7621d3701 100644
--- a/keystone/assignment/controllers.py
+++ b/keystone/assignment/controllers.py
@@ -941,7 +941,8 @@ class RoleAssignmentV3(controller.V3Controller):
     @controller.filterprotected('group.id', 'role.id',
                                 'scope.domain.id', 'scope.project.id',
                                 'scope.OS-INHERIT:inherited_to', 'user.id')
-    def list_role_assignments(self, request, filters):
+    def list_role_assignments(self, request, filters, **kwargs):
+        # not passing kwargs because they were used only for policy check
         return self._list_role_assignments(request, filters)
 
     def _check_list_tree_protection(self, request, protection_info):
@@ -985,4 +986,9 @@ class RoleAssignmentV3(controller.V3Controller):
                 self.query_filter_is_true(params['include_subtree'])):
             return self.list_role_assignments_for_tree(request)
         else:
-            return self.list_role_assignments(request)
+            kwargs = {}
+            scope_project_id = params.get('scope.project.id')
+            if scope_project_id:
+                project = self.resource_api.get_project(scope_project_id)
+                kwargs['scope.project.domain.id'] = project['domain_id']
+            return self.list_role_assignments(request, **kwargs)
-- 
2.13.7